Trace endpoint logging profile, FortiAnalyzer receipt, IoC rule result and EMS classification history. This check would be appropriate for another issue involving fortianalyzer log-to-tag feedback. For the present symptom, begin with: Compare FortiOS build, EMS version, published feature limits and actual received tags.

Check EMS client telemetry and applied policy independently of the FortiGate connector health and tag feed. This check would be appropriate for another issue involving security fabric root versus endpoint control. For the present symptom, begin with: Compare FortiOS build, EMS version, published feature limits and actual received tags.

Inspect FortiGate dynamic address membership, policy conditions and a permitted-versus-denied traffic pair. This check would be appropriate for another issue involving fortigate dynamic policy linkage. For the present symptom, begin with: Compare FortiOS build, EMS version, published feature limits and actual received tags.

Check the vendor-documented quarantine license, client platform and component prerequisites before promising host isolation. This is a response to a different condition, quarantine prerequisites and platform support, under the same Fortinet exam task. The reported issue instead depends on this technical distinction: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Treat queued commands on unreachable endpoints as pending and apply approved network containment until client acknowledgement. This is a response to a different condition, isolation in disconnected endpoint, under the same Fortinet exam task. The reported issue instead depends on this technical distinction: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Distinguish file-level malware quarantine from endpoint-level isolation in EMS and report each status accurately. This is a response to a different condition, quarantine versus file quarantine, under the same Fortinet exam task. The reported issue instead depends on this technical distinction: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

The actual compromised managed device becomes isolated while the legitimate comparison endpoint stays connected. Such a result could confirm a separate case involving quarantine request targets wrong endpoint, but it does not verify the symptom described here. The directly relevant result is: A controlled approved test detection yields a quarantine status in EMS and FortiClient with network access blocked as designed.

The selected supported endpoint platform successfully enters the intended quarantine state during an authorized dry run. Such a result could confirm a separate case involving quarantine prerequisites and platform support, but it does not verify the symptom described here. The directly relevant result is: A controlled approved test detection yields a quarantine status in EMS and FortiClient with network access blocked as designed.

The release record names the approver and shows verified recovery controls before the agent regains access. Such a result could confirm a separate case involving narrow authorization for quarantine release, but it does not verify the symptom described here. The directly relevant result is: A controlled approved test detection yields a quarantine status in EMS and FortiClient with network access blocked as designed.

Not every FortiClient operating system or license supports every EMS quarantine action. This explains another behavior involving quarantine prerequisites and platform support. It does not account for the current incident, whose operative mechanism is: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Quarantining malicious files and quarantining a whole endpoint are different protective actions. This explains another behavior involving quarantine versus file quarantine. It does not account for the current incident, whose operative mechanism is: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Isolation commands must resolve the current managed endpoint identity rather than relying on ambiguous labels or stale addresses. This explains another behavior involving quarantine request targets wrong endpoint. It does not account for the current incident, whose operative mechanism is: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Assuming offline clients have isolated can create a dangerous gap during incident response. That danger is more directly associated with isolation in disconnected endpoint. The neglected condition in this question instead exposes the organization to: An incomplete incident-response chain can leave an active compromised host connected despite a detection.

A mistaken quarantine can interrupt business users and leave the real attacker endpoint unrestricted. That danger is more directly associated with quarantine request targets wrong endpoint. The neglected condition in this question instead exposes the organization to: An incomplete incident-response chain can leave an active compromised host connected despite a detection.

An early release can return an infected host to the production network. That danger is more directly associated with narrow authorization for quarantine release. The neglected condition in this question instead exposes the organization to: An incomplete incident-response chain can leave an active compromised host connected despite a detection.

Inspect detection case, malware remediation results, current posture and administrator action audit. This check would be appropriate for another issue involving narrow authorization for quarantine release. For the present symptom, begin with: Trace IoC event, automation stitch trigger count, EMS notification and endpoint quarantine status.

Review file-quarantine records alongside EMS endpoint quarantine status and permitted network tests. This check would be appropriate for another issue involving quarantine versus file quarantine. For the present symptom, begin with: Trace IoC event, automation stitch trigger count, EMS notification and endpoint quarantine status.

Check last agent contact, pending command state, network access controls and subsequent local isolation confirmation. This check would be appropriate for another issue involving isolation in disconnected endpoint. For the present symptom, begin with: Trace IoC event, automation stitch trigger count, EMS notification and endpoint quarantine status.

Treat queued commands on unreachable endpoints as pending and apply approved network containment until client acknowledgement. This is a response to a different condition, isolation in disconnected endpoint, under the same Fortinet exam task. The reported issue instead depends on this technical distinction: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Correlate the live endpoint identity and detection evidence before sending a quarantine command through EMS. This is a response to a different condition, quarantine request targets wrong endpoint, under the same Fortinet exam task. The reported issue instead depends on this technical distinction: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Distinguish file-level malware quarantine from endpoint-level isolation in EMS and report each status accurately. This is a response to a different condition, quarantine versus file quarantine, under the same Fortinet exam task. The reported issue instead depends on this technical distinction: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

The managed agent eventually confirms isolation, or a separately verified network control blocks exposure while offline. Such a result could confirm a separate case involving isolation in disconnected endpoint, but it does not verify the symptom described here. The directly relevant result is: A controlled approved test detection yields a quarantine status in EMS and FortiClient with network access blocked as designed.

The suspect file remains contained while the endpoint network isolation state is evaluated separately. Such a result could confirm a separate case involving quarantine versus file quarantine, but it does not verify the symptom described here. The directly relevant result is: A controlled approved test detection yields a quarantine status in EMS and FortiClient with network access blocked as designed.

The actual compromised managed device becomes isolated while the legitimate comparison endpoint stays connected. Such a result could confirm a separate case involving quarantine request targets wrong endpoint, but it does not verify the symptom described here. The directly relevant result is: A controlled approved test detection yields a quarantine status in EMS and FortiClient with network access blocked as designed.

Quarantining malicious files and quarantining a whole endpoint are different protective actions. This explains another behavior involving quarantine versus file quarantine. It does not account for the current incident, whose operative mechanism is: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

Isolation commands must resolve the current managed endpoint identity rather than relying on ambiguous labels or stale addresses. This explains another behavior involving quarantine request targets wrong endpoint. It does not account for the current incident, whose operative mechanism is: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

A configured connector address is not equivalent to a mutually authorized Security Fabric relationship. This explains another behavior involving fortigate ems connector authorization. It does not account for the current incident, whose operative mechanism is: Quarantine can involve FortiAnalyzer detection, FortiGate orchestration, EMS command and endpoint enforcement.

An early release can return an infected host to the production network. That danger is more directly associated with narrow authorization for quarantine release. The neglected condition in this question instead exposes the organization to: An incomplete incident-response chain can leave an active compromised host connected despite a detection.

Confusing the two can distort incident severity, business impact and containment validation. That danger is more directly associated with quarantine versus file quarantine. The neglected condition in this question instead exposes the organization to: An incomplete incident-response chain can leave an active compromised host connected despite a detection.

Assuming unsupported quarantine coverage can leave a response plan ineffective for some devices. That danger is more directly associated with quarantine prerequisites and platform support. The neglected condition in this question instead exposes the organization to: An incomplete incident-response chain can leave an active compromised host connected despite a detection.

Check last agent contact, pending command state, network access controls and subsequent local isolation confirmation. This check would be appropriate for another issue involving isolation in disconnected endpoint. For the present symptom, begin with: Trace IoC event, automation stitch trigger count, EMS notification and endpoint quarantine status.

Compare installed client OS, EMS licensing, relevant feature documentation and test result. This check would be appropriate for another issue involving quarantine prerequisites and platform support. For the present symptom, begin with: Trace IoC event, automation stitch trigger count, EMS notification and endpoint quarantine status.

Review file-quarantine records alongside EMS endpoint quarantine status and permitted network tests. This check would be appropriate for another issue involving quarantine versus file quarantine. For the present symptom, begin with: Trace IoC event, automation stitch trigger count, EMS notification and endpoint quarantine status.